Law Professor James Grimmelmann Explains How He Probably Violated The Same Laws As Aaron Swartz

from the and-you-may-have-too dept

We've been discussing the ridiculousness of the prosecution against Aaron Swartz, including the fact that if a federal prosecutor decides to take you down, it's not at all difficult to find something they can try to pin on you, especially when it comes to "computer" crimes. Law professor James Grimmelmann explains how it's quite possible that prosecutors could go after him under the same laws as it went after Swartz. He notes that he used to run the (excellent) blog LawMeme (which we used to link to frequently). After it died, he wanted to preserve many of the articles, and so he wrote a script to pull the articles off of the Internet Archive. While it all depends on your interpretation, he shows how a prosecutor could make the argument that he violated the Internet Arvchive's terms of service -- and that some of the decisions he made in writing the script could be taken out of context to be used against him.

And so I became a bulk downloader. I wrote a Perl script: a simple, 70-line program that exhaustively went through the Wayback Machine, looking for a copy of each LawMeme article. Just like Aaron's script, mine “discovered the URLs” of articles and then downloaded them. And just to show how mainstream this is, I'll add that I built my script around an elementary one that Paul Ohm published in “Computer Programming and the Law: A New Research Agenda,” his manifesto for why more law professors should write code. Paul's script downloaded and analyzed the comment counts on posts from the popular legal blog The Volokh Conspiracy.

[....] take the Internet Archive's terms of service. By using the site, I supposedly promised not "to copy offsite any part of the Collections without written permission." The site's FAQ qualifies this statement a bit, adding, "However, you may use the Internet Archive Wayback Machine to locate and access archived versions of a site to which you own the rights." Again, I was confident that this covered me. But confidence is not certainty. I assumed that no one would care to press the question. After Aaron, is that such a safe assumption?

I can't imagine that the Internet Archive would have a problem with what I did. Recreating lost websites for the sake of the public and posterity is completely consistent with Brewster Kahle's expansive humanist vision of digital archiving. But JSTOR quickly made its peace with Aaron, and that didn't save him. Would Brewster's blessing save me from the wrath of the feds?

As for how to take decisions out of context, how about these:

Indeed, my script waited a second between each download. I didn't want to put too much of a load on the Archive's servers. But a cyber-Javert could describe it as an attempt to evade detection. Then, to get the webpages to display right in the LawMeme archive, I wrote another script to delete the bits of HTML added by the Internet Archive to the pages in its archive. Was that an effort to hide my tracks?

And this, of course, is the crux of the problem. The laws are so broad, and written in such a way that makes so little sense, it's quite easy for a prosecutor who wants to bring someone down to figure out a way to make them look like a felon. That's a very dangerous system. As Grimmelmann notes, the problem won't be solved by a simple fix, but a massive overhaul.

Aaron's Law is a start, but the problems with our computer crime laws, and with criminal law in general, run much, much deeper. The Department of Justice thinks millions of parents who made Facebook accounts for their children are federal criminals. Read the majority opinion in United States v. Nosal and ask yourself whether you've fudged your age on a dating site, or let someone else use your account, or used a workplace computer to check the baseball scores. Judge Kozinski noted, skeptically, "The government assures us that, whatever the scope of the CFAA, it won't prosecute minor violations." Tell that to Aaron's family.

Painted in the worst light, our laws make it so that any of us can be made out to be felons. Off the top of my head, I can't think of how I, too, might be a felon, but I'm sure given some time I could cook up a story for myself as well. And so could pretty much any of you. When you reach such a point, we're no longer dealing with a sensible state and "the rule of law," but a world in which arbitrariness rules, and where a prosecutor with a chip on his or her shoulder can take down almost anyone.

Nosal

There's some really good quotes in the Nosal ruling beyond what were cited.

"Ubiquitous, seldom-prosecuted crimes invite arbitrary and discriminatory enforcement."
-With a network as open as MIT's, and with a user base as smart, technologically competent, and occasionally mischevious as MIT's is known to be, you can take for certainty that similar actions frequently occur and are NOT prosecuted.

"The government assures us that, whatever the scope of the
CFAA, it won’t prosecute minor violations. But we shouldn’t
have to live at the mercy of our local prosecutor."
-That sentence after the first that was quoted sticks out to me. Nor die.

"And it’s not clear we can trust the government when a tempting target comes along."
-Right after the above. Aaron was too tempting a target.

Power vs. Class

This article epitomizes an issue that I don't think has been discussed before.

Who has power in our society? The DoJ wants the power to prosecute anyone that they want, filter through our emails and look into our private lives to find us guilty of crimes.

Why?

Because then they can crush those that have no power. The intellectuals, the poor, and those that look to change the status quo.

Aaron wasn't the first victim of this power struggle. But it ignores a key issue that isn't being talked about where Aaron fits right in: class.

Kim Dotcom has access to funds for his defense. He's upper class to do so. But Dajaz1, Torrentfinder, and Ninja video are lower class, with less access to a justice system that works for them.

What we've experienced for the last 30 years is a class struggle where the weakest among us are the ones victimized the most.

The main victims of our drug war is minorities, affecting communities by depriving them of workers, disproportionate sentencing, and no access to the government. If Aaron had been found guilty, he would be a felon. And he has nothing. No vote. No more education. No more protesting. Possible inhumane treatment and solitary worse than Bradley Manning.

That is the class struggle going on. And you won't hear about it on the news nor see it in most mainstream publications. But you can see the disparity of justice if you're rich or poor if you watch how we treat a corporation such as Universal versus a person like Aaron or Dotcom.

Re:

Re:

It's called, 'calling attention to, and attempting to fix, the situation, system and rules that brought about his death', and you're right, there is nothing disgusting about that, quite the opposite in fact.

Trouble Shooting Network Connection?

What I find troubling is that the common practice of wireless "trouble shooting" is turned into evidence of a crime.

One explanation for why Arron changed his MAC address (without criminal intent) is that he was trying to figure out WHY he was kicked off the network. When your computer doesn't connect, you jog it into requesting another IP address. Problem solved! When you can't connect again, you say "hmmm, what is going on." You request another IP address, but that doesn't work. You ask, "is it a wireless policy because I'm hogging wireless bandwidth?" You then change your mac address. You connect. You conclude, "ah, it is a wireless policy, I'm hogging the bandwidth and MIT doesn't want that; I'll just use the wired connection in the closet." You connect in the closet but you don't want people messing with your laptop (or stealing it), so you cover it.

What was "trouble shooting" turns into evidence of criminal conduct. Be careful next time you try to trouble shoot a network connection.

Laws

Our laws are far too complex and James Madison said it much better than I ever could. "It will be of little avail to the people, that the laws are made by men of their own choice, if the laws be so voluminous that they cannot be read, or so incoherent that they cannot be understood; if they be repealed or revised before they are promulgated, or undergo such incessant changes that no man, who knows what the law is today, can guess what it will be tomorrow. Law is defined to be a rule of action; but how can that be a rule, which is little known, and less fixed?"

it's great that this is getting attention but i just hope people donm't lose sight of the fact that this isn't just computer laws, this shit is systemic, end to end. Overcharging to force a plea with the threat of getting maxed if you insist on your right to trial is simply business as usual for millions of americans caught up in our byzantine web of asshattery we call the justice system.

And so on...

The laws are so broad, and written in such a way that makes so little sense, it's quite easy for a prosecutor who wants to bring someone down to figure out a way to make them look like a felon

It's not just computer laws... look around the west... terrorism, libel in the UK, copyright of course, obsenity laws, "racially motivated voilence" laws, and of course the US ever popular RICO and patriot acts... basically:

Western Government: "You are guilty, but we magnanimously decide not to prosecute unless you annoy us... erm... do something really bad."

Re: Re:

Asked to do this sorta thing daily

I am waaaaay more on the marketing/advertising end of things and, am by no stretch of anyone's imagination, a programmer.

I get asked to "scrape" something at least once daily.

I frankly don't possess the vocabulary to sum up how easy and trivial it is to do this with a few lines of code that any dumbass can flesh out with about 30 seconds of google fu.

That being said, while I often don't do it, based on whatever the end result is supposed to be, I have still scraped/spidered/crawled... mad amounts of shit for non nefarious purposes and am guilty as charged as per this situation.

Its frankly fucking ridiculous and part of a much larger, systemic issue.

It further pains me to think that the world had to lose this kind fellow in order for folks to pull their heads of out of their respective asses.

And, while I am at it, no political career for you, you crazy misguided prosecutorial(is that a word?) bitch. You can go ahead and shelve that idea.

Re:

I find it hard to believe that a law professor could write a shell script. Well, I guess there could be one.

I had a project partner in my senior software development class for my CompSci degree who was an intellectual property lawyer. It was my discussions with him that formed most of my pro-open-source and anti-IP beliefs, and it wasn't because I disagreed with him. He was a damn good programmer, and a member of several open source projects. And he was a pretty good lawyer too.

I work with a psychologist who wrote our intrusion prevention system, because at the time he wrote it, there wasn't any IPSs or IDSs capable of handling the speeds and number of connections we were handling. I've worked with programmers with upper level CS degrees that couldn't hack their way out of a wet paper bag.

I never discount someone's capability based on their education, and I certainly don't value someone who tells me they are a CISSP/Microsoft Cert/Cisco Cert, etc. before I get a chance to work with them.

Re:

Re:

Some cowardly anons seem hell-bent on shaming people into not discussing this whole terrible story. Just bored trolls? Or people with a strong interest in shutting down discussions that may directly or indirectly affect them in ways they would not like?

Re: Trouble Shooting Network Connection?

It all boils down to the fact that everybody is a criminal in the US except that the Government chooses to be lenient if you are a good pawn. Expect your jail population to grow exponentially as people become aware of Govt misdeeds. China must be proud.

I'm a dirty filthy felon. I'm too lazy to put in my actual birthdate in Steam, so when I look at a game that needs the age verfication for violence or whatever, I just scroll down the year a few times and hit accept. I'm so evil. Tomorrow, I will set in my master plan of super villainy and Jay-walk.

You are Fake, James

Did you make a fake account and an alias to go on Internet Archive? No. It's open.

Did you write a script that grabbed other people's articles that were not your own, or not contributed to a site you edited? No.

Did you break into a wiring closet to do this job? No.

Did you wear a bicycle helmet to disguise your face while performing this hack? No.

Did you run away from campus police after you had done this? No.

So why are you pretending in such a fake way that you are "just like" Aaron and "they might get you"?

Honestly, you unicorn fairy-world dwellers think you can accomplish everything through language. If you just say a law is "outdated," why, it must be! Voila! If you think a prosecutor has "overreached," why, that must be true! Because you say so!

Look at the past cases of this nature. No hacker in the US or UK has ever gotten anything remotely resembling 35 years.